Hacker News Reader

Is CSP still recommended? I thought it was considered overkill for little benefit

There is enormous benefit with a _strict_ CSP. It's unfortunately common for a CSP that whitelists CDNs, allows eval, etc, etc. These are arguably worse than not having a CSP at all due to the false sense of security. More details in this excellent writeup at https://storage.googleapis.com/pub-tools-public-publication-....

A lot of it seems specially targeted towards websites with tons of third-party scripts

Isn't that the majority of the web today?

Indeed, but it's messed up that we had to invent all this new standard just to keep including hundreds of Analytics scripts

Yeah, I work on some public-facing sites that have analytics and programmatic ads and the like. Our list of script and frame allows would be pretty long. And since the analytics team own and operate out tag manager, they can inject third-party scripts at will without needing a release which makes maintaining CSP a whole job on its own.

Reply on news.ycombinator.com